08269a18354987e19a2b757ae93f79524be9601719579b156610763fa55f772f

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a64de34bcde5a6fc0b01f1c240958a7b_JaffaCakes118.html
Size

3KB
MD5

a64de34bcde5a6fc0b01f1c240958a7b
SHA1

54522d8d444bedb6831d416f033a298e631d259f
SHA256

08269a18354987e19a2b757ae93f79524be9601719579b156610763fa55f772f
SHA512

ab1a579a36d7ab2cbdcc516acabf8aeb2d445abcef72e60115942533cf9780cd81ecd047a2d24f708a9ead11901db18d6c65b050dba1eae3beafd9919a672241

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802b46e253f1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430136385"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A8CD671-5D47-11EF-9438-E643F72B7232} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000921f4af2248aec4762b577139cf5611efc679f012b70a382e8a311c2a23779a9000000000e80000000020000200000009ff406c7fd2036692b0505a6239c4ecc8b1888f42a197a97d61834168b0f09fd20000000a006af2a32a5ee23dc1a3b68ebf709ffac56912f98b52adc30d7269db6203d9c40000000bccf34b34705a9f8ec97f83b763c6edd0f2a96d3fa3e47ac593128da7b04ab1847634fb96f77923a85407f888f01845e6963cf18f3ce17526856b8a3954cfea9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000004551d54210f1f37ebb70c7e3d39d97cb95a3cb996f18dfdf117e2188938c78fc000000000e8000000002000020000000d173a284ff9aaa1fafee94b590a1cfc1a4352a5f2818b4addfb6e5a2ac195f8590000000301b322ed86c3e4b27e963ac6e3b2c92039472d36b44cf2d1f216f1398d7e749824d90de02435f7ecc87e3c200ad82421e48b14c8853c0cf5018f95fcbc0eea4531554a2ce5cbf88578146d46e27d1f96c512667b219c674328b31e1c59a8c7f054049876c0a6ddcca3f5276855dc43f5f5df098cf7821559c5bfb6c12a9efa47222a2cbbbba05eec8a7df124cb8614c40000000207a817fac88ef4270a3d5df7877b357c06438236e38808d4efa1007858b056a5b59fd0bbbbe37682f0940cb5f9b6e42ca8a9ad1606c7b86c5d533c7bc97a8c9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2572	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2572	iexplore.exe
2572	iexplore.exe
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2132	2572	iexplore.exe	31
PID 2572 wrote to memory of 2132	2572	iexplore.exe	31
PID 2572 wrote to memory of 2132	2572	iexplore.exe	31
PID 2572 wrote to memory of 2132	2572	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a64de34bcde5a6fc0b01f1c240958a7b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93c8bc18eb3738f8319db8d0dbbd6721

SHA1
b4aa52294f0d1f3be8f79ee7a8a4192a4fb08e55

SHA256
9e62decc7bb6edf8f0ae38589006452ae118aa01b529ac000ce311a2d2a3742b

SHA512
9c238fd7d46de20a33850b699504d91ebf88ac157ccd36e7ef8b7f12ef0528aa88ae54b1813b7241aec552efad2f4a6395399051ff0f2a30573988d64fb05679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3233af7b244982c5776810a9f31ead97

SHA1
795c0a7a7622a2b2aa43af18b66555dc8aeffa17

SHA256
ec651c815b90bb19b1f4c4fe8cf266d21fc173ed0d200ba6ab1ae0435b895d6b

SHA512
3ad030dd832890064b11e317a30da6e34a24914c248aa37f46e9dffcf59341e9bac69115d840b66240373ce0d5c0482b3465f9270b632513a303b51a8fe65f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73217e8671371fd7b17648754c9dc619

SHA1
dc4846e6df84582092f4511260f1c25d855ed3be

SHA256
1b00fbcc5632de432bf7cd3895ab1142c478b15027f9707fe896ffe1c45602cb

SHA512
98c850106d3527f44ac78cefa405e1d4e83ebfcaf7631d434804743854dbbf1a5871de806a4b1b3222262f8de07e90b2bb41ef2b791ff8210eb529fd8ba09281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91add0a5cdffe0ce6310b2b1e4638225

SHA1
9e395402b8d8d04a3ac8cc9e6f29eb29ff4a2e1b

SHA256
b6bcaedbf8309795bcf25753789b95b2ac385dce19db0ef57b574498fcb4e6d2

SHA512
6231031a03a11c16b862099207d83f0bd91e6e9f178c56fa0a96819982616c0c01831d4afaca04f214628d09676a767ea68a8ebe155e3c8500b756de7bea97e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8b79c7ef7cbc12fe67271091268b61e

SHA1
04770e9562949309b03e2255a087ea09a3515a97

SHA256
41730ba5e0c3b74b21bab8209d709647a2fc8e6b819e70d8af0eced268c63310

SHA512
b89a4d7e67d2e6b2e6fddb11ffd4c014947289d0349924e25d23215d1eb0e8880209f613517931c9ebe02e0a92c10dbffba397afd8ab71210c498850b7eefda9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43cd6f9d3c903e08c7425ad4633d636c

SHA1
6c39670e31c2f6333ab619edba761cdf16ab55ef

SHA256
76ee710393e983603600d79d871073df3a6382df5f64b0d9634ae353d3acae6f

SHA512
a2126bcd2e20afd8fd360a39480048a8ca9b763b9ca812866510b30395231495b88fe2b1db17ad3b9b498450696ba82167bc90c791f0a769e965f3f1261ab868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3f2c123a0a3a3127937a3f6644c3afd

SHA1
08043c7c976ec8df6c25d6d34b37eec3692299b3

SHA256
b818f9808a4a740e7146bd9fb094a62825913ede975ccf7845ff58a7eacaf4e4

SHA512
366fe79cae52d03692377e56dab385d96185f8456a9fdc7414e56a061ed5833314b841a35c9d1c031afcf0567b9e698be9e6a1b29e443f9015e12cc63fc4ad11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bea0334658efa4590055e903e3b926c

SHA1
a920e0ccb159d7142f46fec6cf42f802bf421415

SHA256
4350fed8034219cae98a69fb80ad4631ffc516374587f87a2f1bd5fae7a9fe77

SHA512
83ffa27b142694ce18be3c031ca21619873cd016b5c4e72da8f1f22cb9b3a3527c57fcd678271cdbb2f1268795940332f6c0883920c267b3e343c9772781b4d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed15a6ee815ac3d0c255ff26978665fc

SHA1
49976b0e12651bfff28ff4a0323bc0fcb9c63d99

SHA256
29204966028391e515656367cc7051c03e6498f292076561750d5709e2a073f1

SHA512
bce879a8261a54d46243b407dcb8ac666a688341772e349a98d138cddd6a90fee5435396465d6d29f5ac8d86a98f9738df1e197a77679945d07afdeee48ad685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ddca4e37287ac1f4312f8be128fe21c

SHA1
fcc7e4526da5d66eeaa88b7eb98c1bfc58d36f6d

SHA256
3b62884a94949e56f75e84cca48f8e23c9859f68ea45cb3b682230a068612376

SHA512
60c07eae9a2f2b724f95fe1f06d2f25cfbcda787eab02cf4c38fcdfd7af434c905658f89e19a2396c7628bb70b38e8657c20451970a1b9945b87aa01e423f3b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2beceaa11ba138af55ad8ed8a8d3ca04

SHA1
8ae91056d7204b9d2facc75078be8d69028edda1

SHA256
c3e03195d1b4f4897bc48bc9301f7d70f722bdc6a26d987ce396c3baaf48f5b4

SHA512
8f70e466942d20296115c1471fdd24f7a474c9e5811d389ce0bfbd8d431a16bbfe91b6fadecd5d3e7a11eb4b8876f4c89bd1dc7b1a49b68913c64f9a328cc475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
790b903768d8c4159cdf99b64259751c

SHA1
3bea6c7812ca86b9620dd0912ae8ef3c85c3434b

SHA256
c0c6fadcc9ef706af54d1a8af844fe5ec220d9265f3f2627482678055658f876

SHA512
0b29d67600585ca540ef8508e8384cb55b33b2742d24045f4b1d390ad260bc9ce7c40dd08a5856d01e429d2b7abd5a5d644c239c34af7841b8d51beb024b0849

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a81ba806fd423f1d3da732ec0605c1c

SHA1
6538a5961169319c2ab1edb6d9a74cba29efd423

SHA256
f112237d338d6388e128183f8350eeecacaba34ae086a159cd0b9c53b39bd7bd

SHA512
6462c74dd0de61f554493f051c84b70c6c7825f66e7b772a4eadc8d759803a0f98b8ebdf2e5a23db16ee1b488ce661a089bb037e1b8e050807e80358b8261fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
297355ed55073c1fb56c14c3bd39c8ee

SHA1
0e3d8ae316c4f9a2175cf5a52838bbf84b3a7d45

SHA256
826a98bbf006530901c9aa8398f7e3c8bc319ff41599009f1f5e9a74d75e86ae

SHA512
cd44e2a949c5adee85a385a36171185d011211506bfffbf96dff01479c69f0cc66ead55db5076f87577500d6681026610a0151c63b97dd0300e6255f2c8bf48a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF78A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF79D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit